The Magento_Catalog/js/price-utils::formatPrice() pollutes the global formatting settings with local ones because of a wrong lodash extend / assignIn usage

dmitry_fedyuk · July 15, 2017, 3:41am

magento/magento2/blob/2.2.0-RC1.4/app/code/Magento/Catalog/view/base/web/js/price-utils.js#L15-L21


var globalPriceFormat = {
    requiredPrecision: 2,
    integerRequired: 1,
    decimalSymbol: ',',
    groupSymbol: ',',
    groupLength: ','
};

github.com

magento/magento2/blob/2.2.0-RC1.4/app/code/Magento/Catalog/view/base/web/js/price-utils.js#L33-L44


/**
 * Formatter for price amount
 * @param  {Number}  amount
 * @param  {Object}  format
 * @param  {Boolean} isShowSign
 * @return {String}              Formatted value
 */
function formatPrice(amount, format, isShowSign) {
    var s = '',
        precision, integerRequired, decimalSymbol, groupSymbol, groupLength, pattern, i, pad, j, re, r, am;


    format = _.extend(globalPriceFormat, format);

Look at the last line:

github.com

magento/magento2/blob/2.2.0-RC1.4/app/code/Magento/Catalog/view/base/web/js/price-utils.js#L44-L44


format = _.extend(globalPriceFormat, format);

Such extend / assignIn usage modifies the first argument:

github.com

lodash/lodash/blob/4.17.4/lodash.js#L12621-L12654


/**
 * This method is like `_.assign` except that it iterates over own and
 * inherited source properties.
 *
 * **Note:** This method mutates `object`.
 *
 * @static
 * @memberOf _
 * @since 4.0.0
 * @alias extend
 * @category Object
 * @param {Object} object The destination object.
 * @param {...Object} [sources] The source objects.
 * @returns {Object} Returns `object`.
 * @see _.assign
 * @example
 *
 * function Foo() {
 *   this.a = 1;
 * }
 *
 * function Bar() {
 *   this.c = 3;
 * }
 *
 * Foo.prototype.b = 2;
 * Bar.prototype.d = 4;
 *
 * _.assignIn({ 'a': 0 }, new Foo, new Bar);
 * // => { 'a': 1, 'b': 2, 'c': 3, 'd': 4 }
 */
var assignIn = createAssigner(function(object, source) {
  copyObject(source, keysIn(source), object);
});

So the globalPriceFormat global price format becomes polluted with a random local format value,

dmitry_fedyuk · July 15, 2017, 6:27am